Vulnerability · Published Jun 12, 2026 · Assigned by GitHub_M

CVE-2026-47244Netty HTTP/2: Advertised MAX_CONCURRENT_STREAMS are not enforced

Medium 5.3

In plain English

A medium-severity uncontrolled resource consumption in netty from netty. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.4%top 67.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, DefaultHttp2Connection.DefaultEndpoint initialises maxActiveStreams/maxStreams to Integer.MAX_VALUE, and Http2Settings never inserts SETTINGS_MAX_CONCURRENT_STREAMS by default (Http2Settings.java:305-307 only clamps a user-supplied value). Unless the application explicitly calls initialSettings().maxConcurrentStreams(n), a Netty HTTP/2 server advertises no limit and enforces none locally. Each open stream allocates a DefaultStream object, PropertyMap slots, flow-controller state and IntObjectHashMap entry; with ~2^30 permissible odd stream IDs a single TCP connection can create hundreds of thousands of long-lived stream objects. This is also the precondition for CVE-2023-44487-style Rapid-Reset amplification, where the absence of a low concurrent cap multiplies backend work. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	netty	no fix listed	DEBIAN-CVE-2026-47244
Debian:13	netty	no fix listed	DEBIAN-CVE-2026-47244
Debian:14	netty	no fix listed	DEBIAN-CVE-2026-47244
Maven	io.netty:netty-codec-http2	4.1.135.Final	GHSA-5x3r-wrvg-rp6q
Maven	io.netty:netty-codec-http2	4.2.15.Final	GHSA-5x3r-wrvg-rp6q
Ubuntu:25.10	netty	no fix listed	UBUNTU-CVE-2026-47244
Ubuntu:26.10	netty	no fix listed	UBUNTU-CVE-2026-47244

Affected products (as reported)

Vendor	Product	Versions
netty	netty	>= 4.2.0.Final, < 4.2.15.Final< 4.1.135.Final

Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

https://github.com/netty/netty/security/advisories/GHSA-5x3r-wrvg-rp6q x_refsource_CONFIRM
https://github.com/netty/netty/releases/tag/netty-4.1.135.Final x_refsource_MISC
https://github.com/netty/netty/releases/tag/netty-4.2.15.Final x_refsource_MISC